Access to Azure Active Directory Subscription - My Role: Unknown

Question

Access to Azure Active Directory Subscription - My Role: Unknown

Nick 1

In portal.azure.com I have two subscriptions.

One of them is the subscription named "Access to Azure Active Directory". As far as I can understand, this subscription was created automatically via the Office 365 subscription I have.

My profile is a Global Administrator. However, I cannot access "Access to Azure Active Directory" subscription as a Global Administrator or with Global Administrator rights. More specifically, when I view "My permissions" in "Access to Azure Active Directory" subscription, it says "You are an administrator on the subscription".

But, when for example I try to view "Activity log" or "Access control (IAM)" in "Access to Azure Active Directory" subscription, it says "DisallowedOperation: The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription."

So, how is it possible to be an administrator on "Access to Azure Active Directory" subscription and also not able to do any action as an administrator?

Any help would be much appreciated.

Regards,
Nick

laughey 51 Reputation points

2024-04-20T23:40:05.4733333+00:00

I just received a email from Microsoft titled "We’re sorry to see you go—learn how to save your data" regarding a subscription name of Access to Azure Active Directory.

I attempted to open a support request to inquire about this communication (as it included very little detail) and was running in circles (because the only subscription I can open a request for is not the one indicated in the email).

And then I find this (via Google) from 2020. It's 2024! A waste of time for such nonsense. This could've been avoided, yet Microsoft fails once again. What a joke.

Come on, Microsoft.
John Hawkins 5 Reputation points

2024-04-26T12:27:18.47+00:00

It’s like you typed up my thoughts.
Moshe Nitzani 45 Reputation points

2024-05-02T20:50:02.4133333+00:00
I received the same email from Microsoft this evening. Needless to say it ruined my evening as I was scrambling to get in touch with their support on the phone (lines closed) or create a support request in Azure for this subscription (failed with errors). Their 'Sorry to see you go' email does not bother to include the crucial information CoPilot provided :

The “Access to Azure Active Directory” subscription is a legacy type that was used before the current Azure Portal. Let me provide some context:

History of the Access to Azure Active Directory Subscription:

These subscriptions were created in the past and were used to connect to the Azure portal.

They were necessary because the older Azure Portal (the classic one) required users to have an associated Azure subscription to access Azure Active Directory and other Azure resources.

The classic Azure roles, such as “Subscription Admin,” “Billing Admin,” and “Co-Administrator,” determined access rights in that environment 1.

However, with the introduction of the current Azure Portal (available at portal.azure.com), this legacy subscription type became obsolete.

Why Are They Deprecated?:
- The new Azure Portal now uses your Azure Active Directory access (also known as your Microsoft Entra ID) directly. - As a result, the “Access to Azure Active Directory” subscriptions are no longer required. - [Microsoft has decided to deprecate these subscriptions](https://learn.microsoft.com/en-us/answers/questions/24134/access-to-azure-active-directory-subscription-my-r)[2](https://learn.microsoft.com/en-us/answers/questions/1640904/access-to-azure-active-directory-will-be-disabled). **What Should You Do?**: - If you have no need for the “Access to Azure Active Directory” subscription, it is safe to delete it. - However, deleting it requires opening a support ticket with Microsoft. - [If you encounter any issues related to this subscription, consider reaching out to Microsoft support for assistance](https://www.jasonfritts.me/2020/04/07/what-is-the-access-to-azure-active-directory-subscription-for/)[3](https://www.jasonfritts.me/2020/04/07/what-is-the-access-to-azure-active-directory-subscription-for/).

In summary, the “Access to Azure Active Directory” subscription served its purpose in the past but is now obsolete. If you don’t need it, you can safely delete it through the appropriate channels. 😊👍

Thank you, Microsoft for inducing a mild panic attack thinking I missed a crucial email or alert.

4 answers

Your answer

laughey 51 Reputation points

2024-04-20T23:40:05.4733333+00:00

I just received a email from Microsoft titled "We’re sorry to see you go—learn how to save your data" regarding a subscription name of Access to Azure Active Directory.

I attempted to open a support request to inquire about this communication (as it included very little detail) and was running in circles (because the only subscription I can open a request for is not the one indicated in the email).

And then I find this (via Google) from 2020. It's 2024! A waste of time for such nonsense. This could've been avoided, yet Microsoft fails once again. What a joke.

Come on, Microsoft.
John Hawkins 5 Reputation points

2024-04-26T12:27:18.47+00:00

It’s like you typed up my thoughts.

Answer 1

Came across this question and this Blog post which had the answer about this same Subscription name.
It's a legacy Subscription. Detail below and in the Blog post.

https://www.jasonfritts.me/2020/04/07/what-is-the-access-to-azure-active-directory-subscription-for/#:~:text=The%20%E2%80%9CAccess%20to%20Azure%20Active%20Directory%E2%80%9D%20subscriptions%20are%20a%20legacy,portal.azure.com).

History of the Access to Azure Active Directory subscription

The “Access to Azure Active Directory” subscriptions are a legacy subscription type that are no longer used. They were used prior to the current Azure Portal (https://portal.azure.com).

At that time the classic Azure portal (https://manage.windowsazure.com) that was used to manage Azure Active Directory and other Azure resources only allowed access if the user had a Azure subscription associated to their user account. It utilized the classic Azure roles such as “Subscription Admin” \ “Billing Admin” \ and “Co-Administrator” only so you had to have one of these roles in order to login. It did not take into account Azure AD roles like Global Administrator etc.

Answer 2

@Nick , The error "Disallowed Operation" is usually thrown by an Azure Service when someone tries to perform any task on it without any proper permission.

Make sure you are either an owner on the subscription or you are the service administrator or co-admin in Azure Subscription to be able to make changes or play around with the Azure Services. if you just want to check any specific Azure Resource, make sure you are added on that Azure Resource with proper permission under IAM section of that resource.

A Global Admin is only for Azure AD and not for the Azure Services.

As for me I am a Global Admin of my tenant but also an owner on the subscription.

Do check the permissions on the resource or on the subscription level and make sure you have proper permissions. Do share a screenshot for us to understand better in case there are more queries around this.

Hope this helps.

Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your query.

Answer 3

Nick 1

@soumi-MSFT , It seems that I cannot access the IAM for that resource, although I am an admin for that resource. It seems like a deadlock.

soumi-MSFT 11,831 Reputation points Microsoft Employee Moderator

2020-04-28T07:02:46.187+00:00

@Nick , Can you check with someone else who has access to this subscription and if he/she can find your actual permission on the subscription or the Azure Resouce?

Also you can run the following PS cmdlet to check on what all resources you have permissions and at what levels:

Get-AzRoleAssignment -SignInName {user_signin_name} | Select DisplayName, Scope, RoleDefinitionName

Also would like to share that Management groups are higher in hierarchy than Azure Subscriptions and hence make sure there are no restrictions on Management Group level.

Answer 4

Really poor handling of this - I also got this notification for one subscription at a client who has 3 of these subscriptions for some reason.

The email gives no indication of the client which makes it hard to troubleshoot, however you can get the tenant id with the following.

function get-tenantIdFromSubscriptionID($subId){

$response = try {(Invoke-WebRequest -UseBasicParsing -Uri "https://management.azure.com/subscriptions/$($subId)?a pi-version=2015-01-01" -ErrorAction Stop).BaseResponse} catch { $_.Exception.Response }

$stringHeader = $response.Headers.ToString() return($stringHeader.SubString($stringHeader.IndexOf("login.windows.net")+18,36))

}

get-tenantIdFromSubscriptionID("cd78--guidfromthemailgoeshere--de")

This at least enabled me to find the tenant from the partner portal.

Our distributor wasn't able to assist as they don't have access to the subscription as it's not purchased through them and attempting to log a support ticket directly online also fails asking me to call but then you end up with Office365 support and not Azure subscription support.

At least I now have confirmation of what was going on. I suspected this was the case but wanted to be 100% sure.

Share via

Access to Azure Active Directory Subscription - My Role: Unknown

4 answers

Your answer